Feeds

Dell does factory fresh virus infections?

Something new to be frightened about!

  • alert
  • submit to reddit

Reducing the cost and complexity of web vulnerability management

How the hell does a virus-infected set of motherboards find their way into the supply chain of a major system vendor? The vendor delivering the bad boards was Dell, and they’re blaming a slipshod supplier and ‘human error’. Yeah – human error. You can read all about it here and here.

The virus in question was a variant of an easily disinfected worm that was festering in the flash memory on the boards. Dell has removed all of the motherboards from their supply chain and rushed replacements to affected customers. That’s good, but it doesn’t make the fact that this happened in the first place any less deplorable.

To me, this situation brings up a range of disturbing scenarios. First, it proves that malware and other nasty, hidden code can be embedded in factory-fresh products and delivered to unsuspecting customers. This is akin to finding a pile of steaming dog crap when you unwrap your Quarter Pounder. Actually, it’s worse than that – the dog pile is pretty easy to detect in most (but not all) takeout dishes and, while certainly disturbing, you probably won’t end up eating it. A virus or Trojan is different.

It’s fortunate that the virus used was easy to detect. What concerns me is that there are vastly more insidious things that can be done along these lines. Why couldn’t some super-villain plant code in a new system that would lie low until a certain set of conditions are met?

For example: it’s dormant until a particular USB key is inserted into the machine; then it comes to life and opens up all sorts of back doors to the system. This same super-villain would have a low-level minion physically inside the data center with instructions to put the key into server x, wait a few minutes, and then pull the key out. Then the minion would casually walk out the door with gigabytes of confidential data and a big, big smirk.

Admittedly, this wouldn’t be easy to pull off. The bad guy would have to make sure that a particular component lands in the right data center, and that he has an insider in position to execute the plan. (The bad guy or bad gal, that is; I want to be fair, and women can be very evil in their own right.)

But how hard would it be if you had a lot of money behind you – or the resources of an entire government (even a small one)? The targets of these types of schemes won’t be confined to top-secret defense labs; there are plenty of juicy databases in commercial and industrial companies.

One of the people I most respect in the industry gave me the following example of just how harmful these types of exploits could prove to be. Those who know their Star Wars history will recall that then-Chancellor Palpatine used a similar technique to become Emperor. His infamous Order 66 was implanted into the clone army and, at the right moment, they slaughtered their Jedi leaders. Blood flowed red and deep that day, and it became known as The Great Jedi Purge.

(I would hyperlink all of these little factoids, but I can’t stand even to copy and paste the wiki links to this crap. As for my pal, he’s not a Star Wars geek – but he is the father of two boys who watched the movies enough to wear out the DVDs, so he picked up the story via osmosis.)

In conclusion: we need to be concerned about the safety of high tech supply chains and wary of vendors. And ambitious chancellors… and clone programming too, I guess. As for me, I’m off to see if I can get Norton to run on our new microwave.

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Wanna keep your data for 1,000 YEARS? No? Hard luck, HDS wants you to anyway
Combine Blu-ray and M-DISC and you get this monster
US boffins demo 'twisted radio' mux
OAM takes wireless signals to 32 Gbps
Apple flops out 2FA for iCloud in bid to stop future nude selfie leaks
Millions of 4chan users howl with laughter as Cupertino slams stable door
No biggie: EMC's XtremIO firmware upgrade 'will wipe data'
But it'll have no impact and will be seamless, we're told
Students playing with impressive racks? Yes, it's cluster comp time
The most comprehensive coverage the world has ever seen. Ever
Run little spreadsheet, run! IBM's Watson is coming to gobble you up
Big Blue's big super's big appetite for big data in big clouds for big analytics
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.